Executive brief
Poweradmin, a web-based control panel for DNS management, contains a flaw in how it handles external logins via OpenID Connect (OIDC). An attacker who can create an account on the same login provider can use a specially crafted username (using similar-looking characters) to trick the system into logging them into a victim's account. This allows the attacker to gain full control over the victim's DNS settings and personal data without knowing their password.
Technical details
Poweradmin maps OIDC/SAML identities to local users using the `oidc_user_links` table. The `oidc_subject` column uses the `utf8mb4_unicode_ci` MySQL collation, which is accent-insensitive (e.g., 'i' equals 'í'). When an attacker authenticates with a subject identifier that is an accent variant of an existing user, the SQL lookup `WHERE oidc_subject = ?` matches the victim's record. The application then assigns the victim's `user_id` to the attacker's session. This allows full account takeover if the attacker can control their subject string at the Identity Provider (IdP). The issue is fixed in versions 4.2.5, 4.3.4, and 4.4.0 by migrating columns to binary collation and using byte-exact matching.
Affected products
- Poweradmin Poweradmin >= 4.1.0, < 4.2.5; >= 4.3.0, < 4.3.4
Timeline
- 2026-07-23: advisory: Initial GitHub Advisory published
- 2026-07-24: disclosed: Full technical details and PoC released
References
- https://api.github.com/users/William957-web
- https://github.com/William957-web
- https://api.github.com/users/William957-web/gists%7B/gist_id%7D
- https://api.github.com/users/William957-web/repos
- https://avatars.githubusercontent.com/u/85293841?v=4
- https://api.github.com/users/William957-web/events%7B/privacy%7D